What happened
On September 16, 2026, an attacker drained about $50,463 from Nimiq's swap-liquidity wallet on Polygon: 26,130.64 USDC, 24,332.49 USDT0 and 0.66 USDC.e. The wallet held unlimited token approvals to two of Nimiq's HTLC handler contracts, which power the Nimiq Wallet's gas-abstracted stablecoin swaps through OpenGSN meta-transactions.
Each handler acted as its own OpenGSN forwarder, paymaster and recipient. Its execute() entrypoint, callable by the RelayHub, performed no signature or nonce check and relied on the handler's own paymaster to verify requests in preRelayedCall(). Because an OpenGSN relay chooses which paymaster to use, the attacker registered their own relay with a paymaster that approved everything, so the real verification never ran. Forged requests in the liquidity wallet's name opened HTLCs that the attacker then redeemed.
Attacker: 0x2258491525C21f334c5a2dc22CE55e55023FC45D. Setup tx: 0xb067efae73637f3564f58af7f6027afc497e81e47624b0048636085c678858c0. Exploit tx: 0xb2ca76dfbfe571742b4b66465b777ab1e06988a8632be1631bef9654cc64d169. According to Verichains, Nimiq suspended gas-abstracted stablecoin trading while it investigated.
How it happened
- The attacker staked 1 POL with the OpenGSN StakeManager and registered a relay manager and worker, becoming a valid relay for the real RelayHub.
- They deployed a malicious paymaster whose
preRelayedCall()accepted every request unconditionally. - For each token they sent a forged relay request through
RelayHub.relayCall()withrequest.fromset to Nimiq's liquidity wallet,forwarderset to the HTLC handler,paymasterset to their own contract, andrequest.dataencoding anopen()call whose recipient was a precomputed CREATE2 address. - The hub asked the attacker's paymaster to approve (it did), then called the handler's
execute(), which skipped signature, nonce and precondition checks and calledtransferFromon the liquidity wallet into a new HTLC. - The attacker deployed the recipient contract at the precomputed address and called
redeem()with a secret they had chosen, moving the USDC, USDT0 and USDC.e to themselves.
Protocol details
Evidence
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
